PT-2026-28167 · Pypi · Yaml

Kq5Y + 1 · Published 2026-03-25 · Updated 2026-04-07 · CVE-2026-33532

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions yaml versions prior to 1.10.3 yaml versions prior to 2.8.3

Description The yaml library is susceptible to a stack overflow when parsing YAML documents. The issue occurs during the node resolution/composition phase, which uses recursive function calls without a depth limit. An attacker providing malicious YAML input, approximately 2–10 KB in size, can trigger a RangeError: Maximum call stack size exceeded. This error is not a YAMLParseError, potentially leading to unexpected exceptions in applications that only handle YAML-specific errors. The impact can range from request failures to the termination of the Node.js process. Flow sequences, with their minimal byte overhead per nesting level, facilitate deep nesting and exacerbate the problem. The library's Parser (CST phase) is not affected, as it employs an iterative, stack-based approach. The affected APIs include YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments().

Recommendations Versions prior to 1.10.3: Upgrade to version 1.10.3 or later. Versions prior to 2.8.3: Upgrade to version 2.8.3 or later.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-33532

GHSA-48C2-RRV3-QJMP

Affected Products

Yaml

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33532.json · Exploit
• https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp · Vendor Advisory
• https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b · Patch
• https://ubuntu.com/security/CVE-2026-33532 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33532 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-33532 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33532 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33532 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33532 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33532 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp · Vendor Advisory
• https://github.com/eemeli/yaml/releases/tag/v1.10.3 · Note
• https://github.com/eemeli/yaml/releases/tag/v2.8.3 · Note
• https://github.com/eemeli/yaml · Note